Send API requests
Every v3 request requires one API key. You can send the key in the apikey
query parameter or a Bearer header. Use one method per request.
Get your API key
Your account provides one API key for both v2 and v3. Store it somewhere safe before you make a request.
Sign in to see your API key.
Use query authentication
Pass your key in the apikey query parameter. This method is convenient for
browser testing and clients that can't set request headers.
curl "https://api.roic.ai/v3.0.0/tickers/AAPL?apikey=YOUR_API_KEY"The parameter name is exactly apikey. v3 doesn't accept the legacy key
spelling.
Use Bearer authentication
Bearer authentication is the recommended method for production applications, server code, and scripts. It keeps your API key out of browser history, proxy logs, analytics, and copied URLs.
Send your key in the Authorization header with the Bearer scheme.
curl "https://api.roic.ai/v3.0.0/tickers/AAPL" \
-H "Authorization: Bearer $ROIC_API_KEY"Send one API key
Choose either query authentication or Bearer authentication for each request.
If you send both, the API returns 401 Unauthorized even when the keys match.
Authentication failures include WWW-Authenticate: Bearer and one stable
error code.
| Code | Meaning |
|---|---|
authentication_required | The request contains no credential. |
multiple_authentication_methods | The request contains both supported methods. |
invalid_authorization_header | The Bearer header is malformed. |
invalid_api_key | The key is empty, repeated, or unknown. |
Protect your API key
Treat your API key like a password. An exposed key can consume your request quota and access data under your plan.
- Store the key in an environment variable or secrets manager.
- Keep the key out of source control, browser bundles, logs, and analytics.
- Send requests from trusted server code when possible.
- Rotate the key after accidental exposure.
Request quotas, response headers, and 429 recovery are covered in
handle rate limits.
Next steps
Continue with response handling or make your first resource request.